UK Gambling Commission Says AI Is Not a Substitute for AML Controls in Britain

The British Gambling Commission says too many operators are leaning on artificial intelligence for anti-money laundering (AML) monitoring without proving that the tools actually work. That matters for high-risk PSPs and gambling merchants because the regulator is not treating “we use AI” as a compliance answer.

1. John Pierce, the Commission’s Director of Enforcement, used his speech at the Gambling Anti-Money Laundering Group (GAMLG) Annual Conference on June 10 to warn against blind reliance on technology. He said the Commission is not opposed to new tools in principle, but firms need evidence that the systems are delivering compliance before they launch them.
2. AI-driven compliance tools can scan large volumes of customer transaction data for irregularities and automatically generate suspicious activity reports (SARs). The Commission’s point is narrower and more annoying for operators: automation can help with screening, but it does not replace the obligation to meet AML standards in practice.
3. Pierce also said the problem is not only the software. Personal Management Licence (PML) holders, who are responsible for overseeing AML at licensed operators, have in some cases failed to exercise adequate oversight. He added that some firms are not using risk-based approaches properly in their internal assessments, either missing risks or not considering them at all.
4. The regulator said it keeps seeing three recurring weaknesses: poor third-party oversight, including inadequate due diligence for white label partnerships; weak record-keeping, including poor documentation of rationale and decision-making; and excessive dependence on financial thresholds instead of proactive customer risk profiling.
5. Pierce said the Gambling Commission often sees a “disconnect between risk assessments and policies and procedures, and the controls put in place to carry out those policies.” He also said senior executives have sometimes been surprised by how policies are applied on the ground, which is usually a sign that the written controls and the actual controls are not the same thing.